MyCity » Ambulanta -> Arhiva Ambulante » brzina konekcije

brzina konekcije

Napisano na dan: 11.4.2008
1

brzina konekcije
Sledeća strana Pagination

Idi na vrh

Poslao: 11 Apr 2008 19:45
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Pre par dana sam promenio AV,i od tada mi je racunar izgubio na konekciji.
Tacnije,nekada moram cekati i do dva minuta da bih otvorio internet.

Logfile of HijackThis v1.99.1
Scan saved at 19:32:44, on 11.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
C:\DOKUME~1\As\LOKALE~1\Temp\{B4B7DA37-2DD5-4453-8FAC-A0B666002C3E}\VistaPerfectionStartButton.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\As\Desktop\HT\HT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = google.at
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.at
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.at
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.at
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
F2 - REG:system.ini: Shell=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CDNSCacheObj Object - {376892AE-1825-4E5F-9F85-23F9640051CC} - C:\WINDOWS\Trntfiltr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TClock2.lnk = C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
O4 - Startup: VistaPerfectionStartButton.lnk = C:\VTPFiles\VistaPerfectionStartButton.exe
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - miniclip.com/games/ricochet-lost-worlds/de/ReflexiveWebGameLoader.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - miniclip.com/igloader/igloader.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIXŽ - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe

Poslao: 11 Apr 2008 19:50
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Skini ComboFix sa jedne od sledecih adresa na Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 11 Apr 2008 20:00
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

ComboFix 08-04-11.1 - As 2008-04-11 19:53:39.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.190 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Dokumente und Einstellungen\As\Lokale Einstellungen\Temporary Internet Files\mxfilerelatedcache.mxc2
C:\WINDOWS\system\system.ini

.
((((((((((((((((((((((( Dateien erstellt von 2008-03-11 bis 2008-04-11 ))))))))))))))))))))))))))))))
.

2008-04-04 22:10 . 2008-04-11 19:26 <DIR> d-------- C:\Programme\DC++
2008-04-04 22:08 . 2008-04-04 22:08 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AdobeUM
2008-03-30 10:45 . 2008-04-06 17:55 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-30 09:34 . 2008-03-30 09:34 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\CyberLink
2008-03-30 00:23 . 2008-03-30 00:23 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe Systems
2008-03-30 00:22 . 2008-03-30 00:22 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared
2008-03-30 00:11 . 2008-03-30 00:11 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\AdobeUM
2008-03-29 23:48 . 2008-03-29 23:48 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\CyberLink
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2008-03-29 23:45 . 2008-03-30 19:36 <DIR> d-------- C:\Programme\Nero
2008-03-29 23:45 . 2008-03-29 23:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Ahead
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Programme\DVD Shrink DE
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DVD Shrink
2008-03-29 23:43 . 2008-03-29 23:43 <DIR> d-------- C:\Programme\Audiograbber
2008-03-29 23:29 . 2008-03-30 02:33 <DIR> d-------- C:\Programme\Winamp
2008-03-29 23:29 . 2008-03-29 23:30 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-03-29 23:15 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\Elantech
2008-03-29 23:15 . 2006-03-17 17:03 27,904 -ra------ C:\WINDOWS\system32\drivers\Ktp.sys
2008-03-29 22:45 . 2008-03-29 22:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Programme\Avira
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-03-29 21:52 . 2008-04-03 22:54 <DIR> d-------- C:\Programme\XoftSpySE
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\TuneUp Utilities 2007
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2007-03-28 20:42 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-03-26 21:55 . 2008-03-26 21:55 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
2008-03-26 19:32 . 2008-03-26 20:54 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-03-19 21:04 . 2008-03-19 21:04 244 --ah----- C:\sqmnoopt07.sqm
2008-03-19 21:04 . 2008-03-19 21:04 232 --ah----- C:\sqmdata07.sqm
2008-03-19 11:25 . 2008-03-19 11:25 244 --ah----- C:\sqmnoopt06.sqm
2008-03-19 11:25 . 2008-03-19 11:25 232 --ah----- C:\sqmdata06.sqm
2008-03-19 09:09 . 2008-03-19 09:09 244 --ah----- C:\sqmnoopt05.sqm
2008-03-19 09:09 . 2008-03-19 09:09 232 --ah----- C:\sqmdata05.sqm
2008-03-17 22:36 . 2008-03-17 22:36 244 --ah----- C:\sqmnoopt04.sqm
2008-03-17 22:36 . 2008-03-17 22:36 232 --ah----- C:\sqmdata04.sqm
2008-03-17 22:32 . 2008-03-17 22:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-17 22:32 . 2008-03-17 22:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 20:49 . 2008-03-30 19:23 58 --a------ C:\WINDOWS\cdplayer.ini
2008-03-15 00:28 . 2008-03-15 00:28 <DIR> d-------- C:\Dokumente und Einstellungen\As\New Folder
2008-03-15 00:05 . 2007-06-30 16:04 17,976,688 --a------ C:\Programme\Install_Messenger.exe
2008-03-14 22:49 . 2008-03-14 22:49 <DIR> d-------- C:\Programme\CDBurnerXP Pro 3
2008-03-14 22:38 . 2008-03-14 22:38 5,632 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-14 22:07 . 2008-03-30 00:27 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Ahead
2008-03-14 20:51 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\LimeWire
2008-03-14 12:29 . 2008-03-14 12:29 <DIR> d-------- C:\Programme\Brother
2008-03-14 12:29 . 2004-12-03 02:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL
2008-03-14 12:29 . 2002-10-31 02:09 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll
2008-03-14 12:29 . 2003-07-03 02:08 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE
2008-03-14 12:29 . 2001-11-15 02:00 6,224 --------- C:\WINDOWS\CVRPAGE.bmp
2008-03-14 12:24 . 2008-03-14 12:35 <DIR> d-------- C:\Programme\SetupDCP115C
2008-03-11 12:43 . 2008-03-11 12:43 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-11 15:59 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-03-29 22:21 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe
2008-03-29 21:47 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-03-29 20:45 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-03-14 10:29 --------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield
2008-03-12 09:51 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-03-09 10:04 54,052 ----a-w C:\Programme\subtitler-2_4.zip
2008-03-09 09:22 1,663,746 ----a-w C:\Programme\VirtualDubMod_1_5_10_2_All_inclusive.zip
2008-03-05 23:29 --------- d-----w C:\Programme\URUSoft
2008-03-05 23:28 1,087,682 ----a-w C:\Programme\subtitleworkshop251.zip
2008-03-01 08:19 --------- d-----w C:\Programme\Gabest
2008-02-25 11:35 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-02-25 10:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-02-25 09:22 --------- d-----w C:\Programme\Common Files
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-02-24 21:49 --------- d-----w C:\Programme\microsoft frontpage
2008-02-21 15:34 --------- d-----w C:\Programme\MAGIX
2008-02-21 14:53 --------- d-----w C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 13:39 --------- d-----w C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-01-26 14:50 81,920 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-14 21:11 16 ---ha-w C:\Programme\Gemeinsame Dateien\mxfilerelatedcache.mxc2
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

2006-12-13 12:35 578560 3751d7cf0e0a113d84414992146bce6a C:\WINDOWS\system32\user32.dll

2006-12-13 12:39 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\system32\wininet.dll

2006-12-13 12:39 360576 bd8686216e34e22c4ed45a2320b2bea1 C:\WINDOWS\system32\drivers\tcpip.sys

2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\ntkrnlpa.exe
2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\ntoskrnl.exe
2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

2004-08-04 01:57 1425920 d1af72fc219fa4e43319bd4e3c821771 C:\WINDOWS\explorer.exe
2004-08-04 01:57 1035264 22fe1be02eadde1632e478e4125639e0 C:\WINDOWS\system32\VITrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]
2007-11-07 16:38 130048 --a------ C:\WINDOWS\Trntfiltr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:57 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 13:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]
"SetDefPrt"="C:\Programme\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 19:02 49152]
"ControlCenter2.0"="C:\Programme\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 18:42 933888]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-29 22:32 249896]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

C:\Dokumente und Einstellungen\As\Startmen\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 22:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 15:23:54 393216]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2008-03-30 00:22:00 25214]
Status Monitor.lnk - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe [2008-03-14 12:29:23 802816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=C:\Programme\Windows Media Player\WMPNSCFG.exe
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
"VisualTooltip"=C:\Programme\VisualTooltip\VisualToolTip.exe
"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"KTPWare"=C:\Programme\Elantech\ktp.exe
"Acrobat Assistant 7.0"="C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=
"C:\\Programme\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=

R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2004-08-04 01:58]
R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-03-17 17:03]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Inhalt des "geplante Tasks" Ordners
"2008-03-29 19:52:04 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-03-29 19:52:53 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Programme\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-04-11 19:55:21
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-04-11 19:55:53
ComboFix-quarantined-files.txt 2008-04-11 17:55:33
10 Verzeichnis(se), 37,089,161,216 Bytes frei
13 Verzeichnis(se), 37,079,859,200 Bytes frei

Poslao: 11 Apr 2008 20:18
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Jel ovo laptop?

Poslao: 11 Apr 2008 20:27
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Da,ovo je laptop

Poslao: 11 Apr 2008 23:06
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Otvoriti Notepad i iskopirati sledeci tekst:

File::
C:\WINDOWS\Trntfiltr.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{376892AE-1825-4E5F-9F85-23F9640051CC}]


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 12 Apr 2008 22:24
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

ComboFix 08-04-11.1 - As 2008-04-12 22:19:03.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.118 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\As\Desktop\ComboFix.exe
Command switches used :: C:\Dokumente und Einstellungen\As\Desktop\CFScript.txt
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\Trntfiltr.dll
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Trntfiltr.dll

.
((((((((((((((((((((((( Dateien erstellt von 2008-03-12 bis 2008-04-12 ))))))))))))))))))))))))))))))
.

2008-04-11 21:11 . 2008-04-11 21:11 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Nullsoft
2008-04-04 22:10 . 2008-04-12 07:42 <DIR> d-------- C:\Programme\DC++
2008-04-04 22:08 . 2008-04-04 22:08 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AdobeUM
2008-03-30 10:45 . 2008-04-11 21:23 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-30 09:34 . 2008-03-30 09:34 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\CyberLink
2008-03-30 00:23 . 2008-03-30 00:23 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe Systems
2008-03-30 00:22 . 2008-03-30 00:22 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared
2008-03-30 00:11 . 2008-03-30 00:11 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\AdobeUM
2008-03-29 23:48 . 2008-03-29 23:48 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\Pegasys Inc
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Programme\CyberLink
2008-03-29 23:47 . 2008-03-29 23:47 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2008-03-29 23:45 . 2008-03-30 19:36 <DIR> d-------- C:\Programme\Nero
2008-03-29 23:45 . 2008-03-29 23:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Ahead
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Programme\DVD Shrink DE
2008-03-29 23:44 . 2008-03-29 23:44 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DVD Shrink
2008-03-29 23:43 . 2008-03-29 23:43 <DIR> d-------- C:\Programme\Audiograbber
2008-03-29 23:29 . 2008-03-30 02:33 <DIR> d-------- C:\Programme\Winamp
2008-03-29 23:29 . 2008-03-29 23:30 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Winamp
2008-03-29 23:15 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\Elantech
2008-03-29 23:15 . 2006-03-17 17:03 27,904 -ra------ C:\WINDOWS\system32\drivers\Ktp.sys
2008-03-29 22:45 . 2008-03-29 22:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Programme\Avira
2008-03-29 22:30 . 2008-03-29 22:30 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-03-29 21:52 . 2008-04-03 22:54 <DIR> d-------- C:\Programme\XoftSpySE
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\TuneUp Utilities 2007
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2008-03-29 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2008-03-29 21:51 . 2007-03-28 20:42 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-03-26 21:55 . 2008-03-26 21:55 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
2008-03-26 19:32 . 2008-03-26 20:54 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-03-19 21:04 . 2008-03-19 21:04 244 --ah----- C:\sqmnoopt07.sqm
2008-03-19 21:04 . 2008-03-19 21:04 232 --ah----- C:\sqmdata07.sqm
2008-03-19 11:25 . 2008-03-19 11:25 244 --ah----- C:\sqmnoopt06.sqm
2008-03-19 11:25 . 2008-03-19 11:25 232 --ah----- C:\sqmdata06.sqm
2008-03-19 09:09 . 2008-03-19 09:09 244 --ah----- C:\sqmnoopt05.sqm
2008-03-19 09:09 . 2008-03-19 09:09 232 --ah----- C:\sqmdata05.sqm
2008-03-17 22:36 . 2008-03-17 22:36 244 --ah----- C:\sqmnoopt04.sqm
2008-03-17 22:36 . 2008-03-17 22:36 232 --ah----- C:\sqmdata04.sqm
2008-03-17 22:32 . 2008-03-17 22:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-17 22:32 . 2008-03-17 22:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 20:49 . 2008-03-30 19:23 58 --a------ C:\WINDOWS\cdplayer.ini
2008-03-15 00:28 . 2008-03-15 00:28 <DIR> d-------- C:\Dokumente und Einstellungen\As\New Folder
2008-03-15 00:05 . 2007-06-30 16:04 17,976,688 --a------ C:\Programme\Install_Messenger.exe
2008-03-14 22:49 . 2008-03-14 22:49 <DIR> d-------- C:\Programme\CDBurnerXP Pro 3
2008-03-14 22:38 . 2008-03-14 22:38 5,632 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-14 22:07 . 2008-03-30 00:27 <DIR> d-------- C:\Dokumente und Einstellungen\As\Anwendungsdaten\Ahead
2008-03-14 20:51 . 2008-03-30 02:32 <DIR> d-------- C:\Programme\LimeWire
2008-03-14 12:29 . 2008-03-14 12:29 <DIR> d-------- C:\Programme\Brother
2008-03-14 12:29 . 2004-12-03 02:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL
2008-03-14 12:29 . 2002-10-31 02:09 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll
2008-03-14 12:29 . 2003-07-03 02:08 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE
2008-03-14 12:29 . 2001-11-15 02:00 6,224 --------- C:\WINDOWS\CVRPAGE.bmp
2008-03-14 12:24 . 2008-03-14 12:35 <DIR> d-------- C:\Programme\SetupDCP115C

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-12 05:40 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\LimeWire
2008-03-29 22:21 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe
2008-03-29 21:47 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-03-29 20:45 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-03-14 10:29 --------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield
2008-03-12 09:51 34,520 ----a-w C:\Dokumente und Einstellungen\As\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-03-09 10:04 54,052 ----a-w C:\Programme\subtitler-2_4.zip
2008-03-09 09:22 1,663,746 ----a-w C:\Programme\VirtualDubMod_1_5_10_2_All_inclusive.zip
2008-03-05 23:29 --------- d-----w C:\Programme\URUSoft
2008-03-05 23:28 1,087,682 ----a-w C:\Programme\subtitleworkshop251.zip
2008-03-01 08:19 --------- d-----w C:\Programme\Gabest
2008-02-25 11:35 --------- d-----w C:\Dokumente und Einstellungen\As\Anwendungsdaten\BearShare
2008-02-25 10:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-02-25 09:22 --------- d-----w C:\Programme\Common Files
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe
2008-02-24 22:06 70,144 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-02-24 21:49 --------- d-----w C:\Programme\microsoft frontpage
2008-02-21 15:34 --------- d-----w C:\Programme\MAGIX
2008-02-21 14:53 --------- d-----w C:\Programme\Gemeinsame Dateien\MAGIX
2008-02-21 13:39 --------- d-----w C:\Programme\Gemeinsame Dateien\Hypnotizer
2008-02-18 10:47 --------- d-----w C:\Programme\Windows Media Connect 2
2008-01-26 14:50 81,920 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-01-24 22:57 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-24 22:57 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-01-14 21:11 16 ---ha-w C:\Programme\Gemeinsame Dateien\mxfilerelatedcache.mxc2
2007-08-22 18:24 16 ---ha-w C:\Programme\mxfilerelatedcache.mxc2
2007-06-26 14:10 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
2007-06-26 14:10 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007062620070627\index.dat
.

------- Sigcheck -------

2006-12-13 12:35 578560 3751d7cf0e0a113d84414992146bce6a C:\WINDOWS\system32\user32.dll

2006-12-13 12:39 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\system32\wininet.dll

2006-12-13 12:39 360576 bd8686216e34e22c4ed45a2320b2bea1 C:\WINDOWS\system32\drivers\tcpip.sys

2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\ntkrnlpa.exe
2006-12-13 12:48 2059136 bdff8ffa77ee7df9758ef8c1e0da8eff C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\ntoskrnl.exe
2006-12-13 12:35 2181632 7189a2391adc1f65c9ae87b0abe0f945 C:\WINDOWS\system32\VITrans\ntoskrnl.exe

2004-08-04 01:57 1425920 d1af72fc219fa4e43319bd4e3c821771 C:\WINDOWS\explorer.exe
2004-08-04 01:57 1035264 22fe1be02eadde1632e478e4125639e0 C:\WINDOWS\system32\VITrans\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-04-11_19.55.28,34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-11 17:53:48 71,492 ----a-w C:\WINDOWS\system32\perfc007.dat
+ 2008-04-12 20:19:10 71,492 ----a-w C:\WINDOWS\system32\perfc007.dat
- 2008-04-11 17:53:48 59,380 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-12 20:19:10 59,380 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-11 17:53:48 406,614 ----a-w C:\WINDOWS\system32\perfh007.dat
+ 2008-04-12 20:19:10 406,614 ----a-w C:\WINDOWS\system32\perfh007.dat
- 2008-04-11 17:53:48 393,272 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-12 20:19:11 393,272 ----a-w C:\WINDOWS\system32\perfh009.dat
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:57 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="C:\Programme\Realtek\InstallShield\AzMixerSel.exe" [2006-04-15 13:35 53248]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]
"SetDefPrt"="C:\Programme\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 19:02 49152]
"ControlCenter2.0"="C:\Programme\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 18:42 933888]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-29 22:32 249896]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

C:\Dokumente und Einstellungen\As\Startmen\Programme\Autostart\
TClock2.lnk - C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe [2007-06-26 22:20:20 90624]
VistaPerfectionStartButton.lnk - C:\VTPFiles\VistaPerfectionStartButton.exe [2007-06-28 15:23:54 393216]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2008-03-30 00:22:00 25214]
Status Monitor.lnk - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe [2008-03-14 12:29:23 802816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=C:\Programme\Windows Media Player\WMPNSCFG.exe
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
"VisualTooltip"=C:\Programme\VisualTooltip\VisualToolTip.exe
"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"KTPWare"=C:\Programme\Elantech\ktp.exe
"Acrobat Assistant 7.0"="C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\DC++\\DCPlusPlus.exe"=
"C:\\Programme\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=

R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2004-08-04 01:58]
R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-03-17 17:03]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Inhalt des "geplante Tasks" Ordners
"2008-03-29 19:52:04 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-03-29 19:52:53 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Programme\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, gmer.net
Rootkit scan 2008-04-12 22:20:32
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-04-12 22:21:03
ComboFix-quarantined-files.txt 2008-04-12 20:20:44
10 Verzeichnis(se), 37,311,090,688 Bytes frei
13 Verzeichnis(se), 37,298,479,104 Bytes frei

Poslao: 12 Apr 2008 22:46
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

Skeniraj ponovo sa HJT-om i postavi mi log.

Poslao: 13 Apr 2008 18:35
Idi na vrh
offline
  • Pridružio: 30 Jan 2008
  • Poruke: 113

Logfile of HijackThis v1.99.1
Scan saved at 18:31:33, on 13.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
C:\DOKUME~1\As\LOKALE~1\Temp\{A8E9AEDE-5021-46FE-9431-3A83619802AF}\VistaPerfectionStartButton.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\internet explorer\iexplore.exe
C:\Dokumente und Einstellungen\As\Desktop\HT\HT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.at
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.at
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: TClock2.lnk = C:\Programme\Servis (Mare)\Clock (tclock2)\tclock2.exe
O4 - Startup: VistaPerfectionStartButton.lnk = C:\VTPFiles\VistaPerfectionStartButton.exe
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - miniclip.com/games/ricochet-lost-worlds/de/ReflexiveWebGameLoader.cab
O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - miniclip.com/igloader/igloader.CAB
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIXŽ - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe

Iskreno se izvinjavam sto ne odgovaram u adekvatnom vremenu,ali malo sam u skripcu sa vremenom,pa sam rastrzan na par strana

Poslao: 13 Apr 2008 18:39
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8617
  • Gde živiš: Novi Beograd

I ja sam u skripcu pa ces malo sacekati dalja uputstva. Neutral

MyCity » Ambulanta -> Arhiva Ambulante » brzina konekcije

Ko je trenutno na forumu
 

Ukupno su 731 korisnika na forumu :: 38 registrovanih, 6 sakrivenih i 687 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., antonije64, cavatina, ccoogg123, celik, CikaKURE, comi_pfc, crnitrn, deLacy, Dimitrise93, DonRumataEstorski, Dorcolac, DPera, Karla, Krusarac, Krvava Devetka, kybonacci, ljuba, madza, Marko Marković, mercedesamg, Mi lao shu, mikrimaus, mnn2, ruger357, saputnik plavetnila, Smiljke, Srle993, StepskiVuk, TheBeastOfMG, uruk, vathra, VJ, vlajkox, wolf431, xaver, YugoSlav, Zoca